diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2383c93..e90ba0d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,20 @@ one of them changed. An entry says which artefact and which version, so `web 0.1
 Every version published to a channel appears here. Nothing is written from memory afterwards: a build
 cannot be published without its entry.
 
+## 2026-10-23 — A command is never run twice when a machine's connection moves `api 2.1.4`
+
+**A command, a service restart or an agent update reaches the machine once.** With several API
+replicas, a machine whose connection moved to another replica while a command was running could be
+sent that command a second time. These calls are now sent at most once. If the connection moves
+while one is in flight, the assistant is told it may have run in part, or not at all, and to check
+its effect before running it again — never simply to try again. Reads still follow the machine.
+
+**An agent update is no longer reported applied when it never left.** If the replica asked to
+deliver it had already lost the machine's connection, the update was reported as applied while
+nothing reached the agent. It now goes to the replica that holds the connection, once.
+
+Update the api image. No web or agent update is required.
+
 ## 2026-10-23 — Steps, reports and links read as they should `api 2.1.3` `web 2.1.8`
 
 **A command waiting for your approval fits on screen again.** In a conversation, the command of a